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FOREWORD 


This document contains the final draft three-year Risk-based Audit Plan from 2016-17 to 
2018-19 for Fisheries and Oceans Canada. 


This Plan is presented to the Departmental Audit Committee for review and recommendation 
for approval by the Deputy Minister. In addition, the Plan will be updated as required based 
on an assessment of current risks and therefore, further changes may occur, and the timing or 
scope of some engagements may change. These adjustments and changes required to the 
Plan will be presented to the Departmental Audit Committee for recommendation to the 
Deputy Minister for approval. 
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1.0 INTRODUCTION 


Fisheries and Oceans Canada’s Internal Audit Directorate plays an important role in supporting 
the Department’s operations by providing assurance and consulting services in relation to all 
important aspects of departmental strategies, systems, practices and management control 
frameworks consisting of governance, risk management, and internal controls. Where control 
weaknesses exist and where the achievement of Fisheries and Oceans Canada’s objectives may 
be at risk, the Internal Audit Directorate plays a role in providing constructive insight and 
recommendations for the strengthening of departmental operations. In this way, the Internal 
Audit Directorate contributes to enhanced departmental accountability and performance. 


The Government of Canada’s Standards for the professional practice of internal audit are based 
on the International Standards for the Professional Practice of Internal Audit prescribed by the 
Institute of Internal Auditors. The Standards stipulate that the role of internal audit is to provide 
assurance that the system of internal control is adequate and effective to manage risk at a level 
that is acceptable to management. 


The internal audit function in the federal government is guided by the 2012 Treasury Board (TB) 
Policy on Internal Audit. The objective of this policy is to contribute to the improvement of 
public sector management by ensuring a strong, credible, effective and sustainable internal 
audit function within departments as well as government-wide. The expected results of the 
Policy on Internal Audit include the following: 

o Deputy heads are effectively supported in their role of accounting officer by a strong, 
credible internal auditing regime that contributes directly to sound risk management, 
control and governance; and is independent from line management. 

o Deputy heads are provided with independent assurance from internal audit, and advice 
from the Audit Committee, regarding the effectiveness of risk management, control and 
governance processes, at the departmental level and the Comptroller General is provided 
with the same at the government-wide level. 


In line with the TB Policy on Internal Audit and supporting TB Directive on Internal Auditing in 
the Government of Canada, the main objectives of the internal audit function and the Chief 
Audit Executive include: 

o Providing independent, objective assurance to senior management on the adequacy and 
effectiveness of risk management, control, and governance processes within the 
Department. 

o Establishing and updating at least annually a multi-year plan of internal audit 
engagements based on a risk assessment and which is focused predominantly on the 
provision of assurance services. 

o Coordinating internal auditing activities and plans with other assurance providers to 
minimize duplication of effort and demands on departmental management. 

o Communicating the plan of engagements and resource requirements for the internal audit 
function, including any variances to this plan and the impact of resource limitations to 
the Deputy Head and the Audit Committee. 

o Ensuring that internal audit resources are appropriate and effectively deployed to achieve 
the approved plan. 

o Ensuring the timely completion of internal audit engagements, including horizontal audits 
led by the Comptroller General. 

o Ensuring that internal audit engagement reports are provided to the Audit Committee in a 
timely manner. 
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o Reporting to the Audit Committee on whether management's action plans have been 
implemented. 


o Ensuring that internal auditors have appropriate professional qualifications and skills and 
opportunities to maintain and develop their internal auditing competence. 


o Developing and maintaining a quality assurance and improvement program that covers all 
aspects of the internal audit function and continuously monitoring its effectiveness, 
including ensuring that a practice inspection of the internal audit function is conducted at 
least every five years, by a qualified independent reviewer competent in the professional 
practice of internal auditing and the external assessment process. 

o Ensuring that the Internal Auditing Standards for the Government of Canada are followed. 

o Providing an annual report to the Deputy Head and the Departmental Audit Committee. 


This three-year Risk-based Audit Plan is a key component of a rigorous audit regime delivered by 
qualified audit professionals that contributes to the effectiveness of governance, risk 
management and internal controls over the delivery of Fisheries and Oceans Canada’s programs 
and corporate activities. 


14 BACKGROUND 


The development of the Risk-based Audit Plan is consistent with the requirements of the 
Treasury Board Policy on Internal Audit, and the Plan is based on an assessment of risks that 
could adversely affect Fisheries and Oceans Canada. A collaborative and consultative approach 
has been used to identify and assess the most significant risks faced by the Department. This 
included the consultation of several internal and external sources of information as well as 
consultations with all Departmental Management Committee members. 


In developing the Risk-based Audit Plan for 2016-2019, the Internal Audit Directorate took into 
consideration the economic environment in which the Department is operating and the 
transformational changes it is implementing, including the revised priorities identified in the 
Minister’s Mandate Letter issued in November 2015. 


The Plan also reflects the planned government-wide horizontal internal audits by the Office of 
the Comptroller General and other external assurance service providers. Lastly, while 
engagement priorities are established at the beginning of the fiscal year, a number of factors 
may lead to adjustments to the Plan throughout the year. These adjustments and any other 
changes required will be presented to the Departmental Audit Committee and Deputy Minister 
for approval. This Plan is an evergreen document. 


1.2 _ PURPOSE 


This document, developed by the Internal Audit Directorate, outlines the Risk-based Audit Plan 

for Fisheries and Oceans Canada. The Risk-based Audit Plan has been designed with the objective 

of: 

e identifying the priorities of the internal audit activity based on an assessment of risk and 
potential exposure that may affect Fisheries and Oceans Canada entities’ ability to 
accomplish their objectives; 


e coordinating activities with external assurance service providers and ensuring that 
government-wide audits led by the Comptroller General are taken into account to ensure 
proper coverage and minimize duplication of effort; 


e ensuring the provision of services that are predominantly assurance-based; and 
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e allocating internal audit resources to those areas that represent the highest risk and 
significance and ensuring that sufficient work is completed to support an annual overview 
report of aggregated findings. 


This Plan is risk-based and, as such, is designed to ensure that audit resources are allocated to 
those areas that represent the highest risk and significance to the organization. This approach is 
paramount to ensure that our services will be of greatest benefit to the organization. It provides 
the Deputy Minister, the Departmental Management Committee and the Departmental Audit 
Committee with a detailed schedule of planned activities for 2016-17 and an overview of 
potential areas for audit engagements for the following two years. 


This Plan includes the following sections: 
Internal Audit Directorate (Section 2) 
Approach/Methodology (Section 3) 
Audit Plan Summary (Section 4) 

Audit Resources (Section 5) 

Summary of Audit Coverage (Section 6) 
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1.3 FISHERIES AND OCEANS CANADA 


Fisheries and Oceans Canada is responsible for developing and implementing policies and 
programs in support of Canada's scientific, ecological, social and economic interests in oceans 
and freshwaters. The Canadian Coast Guard, a Special Operating Agency within Fisheries and 
Oceans Canada, is responsible for services and programs that contribute to the safety, security 
and accessibility of Canada’s waterways. The Canadian Coast Guard also contributes to the 
objectives of other government organizations through the provision of a civilian fleet and a 
broadly distributed shore-based infrastructure. 


Fisheries and Oceans Canada is a national and international leader in marine safety and in the 
management of oceans and freshwater resources. Departmental activities and presence on 
Canadian waters help to ensure the safe movement of people and goods. As an economic and 
sustainable development department, the Department integrates environment, economic and 
social perspectives to ensure Canada’s oceans and freshwater resources benefit this generation 
and those to come. 


The Department’s guiding legislation includes the Fisheries Act, which confers responsibility to 
the Minister for the management of fisheries, habitat and aquaculture and the Oceans Act, which 
charges the Minister with leading oceans management and providing Canadian Coast Guard and 
hydrographic services on behalf of the Government of Canada. The Department also shares, with 
Environment Canada and Parks Canada, responsibility for the Species at Risk Act, which charges 
the Minister with the responsibilities associated with the management of aquatic species at risk 
in Canada. 
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2.0 INTERNAL AUDIT DIRECTORATE 


2.1 ORGANIZATION 


The Department’s internal audit activity is led by the Chief Audit Executive who reports directly 
to the Deputy Minister. The Chief Audit Executive is responsible for establishing a multi-year 
Risk-based Audit Plan consistent with the Department’s objectives and priorities, and for 
maintaining a quality assurance and improvement program to monitor the Internal Audit 
Directorate’s effectiveness. The Chief Audit Executive is also responsible for ensuring internal 
audit resources are professionally qualified and appropriately trained. In addition, the Chief 
Audit Executive communicates relevant information, including internal audit findings, to senior 
management, the Departmental Audit Committee, the Deputy Minister and, as appropriate, the 
Office of the Comptroller General. 


The Internal Audit Directorate consists of two distinct but complementary functions namely 
Internal Audit Services and Professional Practices, led by a senior director and a director 
respectively, both reporting to the Chief Audit Executive. The Internal Audit Services function is 
responsible for providing assurance and consulting services while the Professional Practices 
function supports the internal audit activity and is responsible for the quality assurance and 
improvement program, external audit liaison services and the Departmental Audit Committee 
secretariat. 


2.2 DEPARTMENTAL AUDIT COMMITTEE 


The Departmental Audit Committee is an essential part of the Department’s governance 
structure and of the audit regime established by the TB Policy on Internal Audit. The 
Departmental Audit Committee provides the Deputy Minister with independent, objective advice, 
guidance and assurance on the adequacy of the Department’s risk management, controls, 
governance processes and audit capacity. 


In order to fulfill its role, the Departmental Audit Committee is responsible to review a number 
of documents prepared by the Internal Audit Directorate, and to recommend their approval to 
the Deputy Minister. These documents include: 
o a departmental internal audit charter; 
o the multi-year Risk-based Audit Plan; and 
o internal audit reports and corresponding management action plans to address 
recommendations. 


In addition, the Departmental Audit Committee is responsible to: 

o review regular reports on progress against the Risk-based Audit Plan; 

o provide advice to the Deputy Head on the sufficiency of resources of the internal audit 
function; 

o monitor and assess the performance of the internal audit function; 

o provide advice to the Deputy Head on the recruitment and appointment, as well as on the 
performance, of the Chief Audit Executive; and 

o ensure they are made aware of internal audit engagements or tasks that do not result in a 
report to the Committee, and be informed of all matters of significance arising from such 
work. 


The Departmental Audit Committee is composed of the Deputy Minister, the Associate Deputy 
Minister and three external members. The Committee is chaired by one external member. In 
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addition, the Commissioner of the Canadian Coast Guard, the Chief Financial Officer, the Senior 
General Counsel, the Assistant Deputy Minister Human Resources & Corporates Services and the 
Chief Audit Executive are permanent observers of the Departmental Audit Committee. 


2.3 RESOURCES 


The total budget (salary, operations and maintenance funding) of the Internal Audit Directorate 

for fiscal year 2016-17 will be approximately $2.5 million. With the planned staffing actions, it is 
anticipated that the internal audit function will be delivered through 23 full-time equivalents in 

2016-17. 


2.4 INTERNAL AUDIT SERVICES 


Internal audit takes a disciplined, evidence-based approach to provide assurance that key 
systems and processes are appropriately designed and are functioning as intended. As a 
complement to its assurance role, and within its sphere of expertise, the Internal Audit 
Directorate also provides consulting services. 


This Risk-based Audit Plan factors in the needs for consulting services to best support 
management while maintaining Internal Audit’s objectivity. 


Sections 2.4.1 and 2.4.2 describe the various assurance and consulting services provided by the 
Internal Audit Directorate. 


2.4.1 Assurance Services (Internal Audits and Reviews) 
Internal Audits 


An internal audit provides an objective examination of evidence for the purpose of providing an 
independent assessment of governance, risk management, and control processes within the 
organization. Audits may include financial, performance, compliance, system security, and due 
diligence engagements. 


Reviews 


A review is an assessment of a process or a program designed to provide a lower level of 
assurance and to be completed in a shorter period of time than an audit, so that results could 
serve as an early indicator to management of areas of concern within the process or program. 


2.4.2 Consulting Services 
Continuous Auditing 


Continuous auditing (also known as “Technology-assisted auditing”) is a methodology which can 
assist the Internal Audit Directorate operate more effectively and efficiently. Continuous 
auditing could be used as a stand-alone project or at the beginning of each engagement to assist 
the audit team in understanding the audit entity, identifying high-risk areas, and developing the 
engagement scope and objective(s). 
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Readiness Assessment 


A readiness assessment is performed to objectively assess management’s state of preparedness 
against a set of objective criteria. As such, it is sometimes called a pre-audit. 


Process Mapping 


The purpose of process mapping is to conduct a detailed analysis of each aspect of a program 
and identify key control points. This will assist management in ensuring that they have controls 
in place to mitigate potential risks. This technique could be used in the context of a stand-alone 
project or during the planning phase of an internal audit engagement. 


Control Self-Assessment 


A control self-assessment is a technique that allows managers and work teams directly involved 
in business units, functions or processes to participate in assessing the organization's risk 
management and control processes. Internal Audit’s role would be to facilitate the session and 
provide a summary result report at the end of the session. In its various formats, a control self- 
assessment session can cover objectives, risks, controls and processes. A control self-assessment 
session normally results in concrete, useable action plans to better manage risks and capitalize 
on opportunities. 


Advice and Other Professional Services 


On occasion, the Internal Audit Directorate could provide other advice to senior management. 
Providing such advice and support will depend on resource availability. 


2.5 Professional Practices 


2.5.1 Liaison with the Office of the Comptroller General and participation in their 
Horizontal Internal Audits 


As outlined in the Treasury Board Policy on Internal Audit, the Internal Audit Directorate must 
consider government-wide audits led by the Comptroller General when developing the Risk-based 
Audit Plan. Horizontal audits planned by the Office of the Comptroller General were taken into 
account in the 2016-2019 Risk-based Audit Plan. 


The Office of the Comptroller General has adopted a collaborative approach in conducting 
horizontal internal audits by sharing the work between the Office of the Comptroller General and 
the Internal Audit groups in departments. When conducting a horizontal audit in large 
departments and agencies, the Office of the Comptroller General performs the planning of the 
audit and prepares the audit work programs including the steps to take for documentation 
review and interview questionnaires. The Office of the Comptroller General then requires the 
Internal Audit Directorate of the participating departments to provide audit resources (normally 
one or two) to complete the examination phase and provide fact sheets to the Office of the 
Comptroller General within a 12-week window. The Office of the Comptroller General may assist 
the Internal Audit Directorate staff in the field to ensure consistency in the way the work is 
being carried out across large departments and agencies. Each department may decide to 
expand the scope of a horizontal audit to address matters of significance specific to their 
department. 
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2.5.2 Liaison with the Office of the Auditor General and other External Assurance 
Providers 


The Internal Audit Directorate’s management of liaison activities with the Office of the Auditor 
General, the Office of the Comptroller General, and other external assurance providers helps 
ensure that the activities of the Department are represented accurately, fairly and in a balanced 
manner. Various activities are carried out to ensure positive working relationships and effective 
coordination of all external audit work. Specifically, this includes providing assistance to 
departmental officials throughout the conduct of audits, negotiating acceptable timeframes for 
providing requested material, as well as collaborating with others when validating the factual 
content of audit reports and preparing departmental responses. 


In addition, ministerial responses to petitioners with regards to environmental petitions are 
coordinated with the appropriate Agency/Sectors. 


2.5.3 Follow-up on Management Action Plans 


The Internal Audit Directorate actively and vigorously monitors and reports on the 
implementation of approved Management Action Plans to address internal audit 
recommendations, as well as recommendations stemming from external audits performed by the 
Office of the Auditor General and other external assurance providers. As part of the follow-up 
process, the Internal Audit Directorate requests updates from management, assesses and 
validates corrective measures that have been taken and determines whether the actions carried 
out are appropriate. 


The Internal Audit Directorate has a strong follow-up process. Status updates are requested on a 
semi-annual basis from the auditees and a summary is presented at the Departmental Audit 
Committee meeting for approval. The process also involves assessing the risks associated with 
delays in implementation. When the implementation of a Management Action Plan is delayed, 
the representative from the relevant Agency/Sector is required to attend the Departmental 
Audit Committee meeting to explain the reasons for the delays and to request an extension. 


When there is a high risk that the corrective actions may not be completed as reported by the 
auditee, the Internal Audit Directorate may conduct a more comprehensive follow-up audit. 
Follow-up audit reports are tabled and approved at the Departmental Audit Committee and 
posted on the Directorate intranet site and provided to the Office of the Comptroller General, as 
for regular internal audit engagements. 


2.5.4 Support to the Departmental Audit Committee 


The Internal Audit Directorate provides administrative and logistical support to the Departmental 
Audit Committee members in order to coordinate and organize the quarterly meetings. This 
includes the preparation of the Committee meeting agenda, and the collecting and assembling of 
meeting material into electronic binders for submission to Departmental Audit Committee 
members two weeks in advance of each meeting. The Internal Audit Directorate also provides 
support for the preparation of the Departmental Audit Committee Annual Work Plan and Report. 


2.5.5 Quality Assurance and Improvement Program 


Pursuant to the Treasury Board Policy on Internal Audit, the Government of Canada adopted the 
Institute of the Internal Auditors International Professional Practices Framework and the 
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International Standards for the Professional Practice of Internal Audit as part of the Government 
of Canada Internal Audit Standards. As part of the Standards, the Chief Audit Executive is 
responsible to develop and maintain a quality assurance and improvement program, including 
the conduct of an external quality assessment of the internal audit function at least every five 
years. 


The quality assurance and improvement program activities also include an internal quality 
assessment of all phases of an audit. To complement its quality assessment activities at the 
audit engagement level, the Directorate performs annual internal assessments at the audit 
function level. The last assessment was performed during Summer 2015 in preparation of the 
external practice inspection. 


The Internal Audit Directorate had a practice inspection conducted during the Fall of 2015. 
Consequently, the IA Activity was found to be Generally Conforming to the requirements of the 
TB Policy on Internal Audit and the associated Directive, the Government of Canada IA Standards 
and the IIA Standards. 


3.0 APPROACH/METHODOLOGY 


3.1 AUDIT UNIVERSE 


The Department’s activities are organized under three strategic outcomes: 
o Economically Prosperous Maritime Sectors and Fisheries; 
o Sustainable Aquatic Ecosystems; and 
o Safe and Secure Waters. 


Supported by scientific excellence, modern and efficient corporate functions and a versatile 
Coast Guard fleet, these strategic outcomes form the basis for organizing, planning and reporting 
on the Department's programs and services. 


These strategic outcomes are the basis of the Department’s Program Alignment Architecture for 
2015-16. The Program Alignment Architecture is an inventory of all the programs and activities 
undertaken by the Department. The Program Alignment Architecture was a major input into the 
definition of the audit universe. The audit universe, which forms the basis for selecting areas to 
audit, defines the potential scope of the internal audit activity and is comprised of major 
auditable units that may be subject to audit. It is the starting point of the Risk-based Audit 
Plan. 


3.2 CORPORATE RISK PROFILE 

The Risk-based Audit Plan takes into consideration the Corporate Risk Profile for Fisheries and 
Oceans Canada. The Corporate Risk Profile consists of: identification, assessment and 
prioritization of key corporate risks; assignment of senior management accountabilities for 
mitigation; and identification of additional mitigation strategies. 


3.3 PLANNING PROCESS 


This Plan represents an update of the Risk-based Audit Plan for 2015-2018 that was supported by 
the Departmental Audit Committee and approved by the Deputy Minister in March 2015. 
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The Risk-based Audit Plan for 2016-2019 was developed in accordance with the Treasury Board 
Policy on Internal Audit. The procedures taken to develop the 2016-2019 Risk-based Audit Plan 
were based on the Office of the Comptroller General Practice guidebook entitled “Internal Audit 
Planning for Departments and Agencies” as well as best practices/areas of improvement found 
during last year’s update. Fisheries and Oceans Canada’s 2015-16 Program Alignment 
Architecture was used to develop the audit universe. This universe represents the inventory of 
auditable entities in the department organized by strategic outcome. 


Building on last year’s assessment and process, the internal audit team undertook the following 
activities to identify high-risk areas and subsequently develop the Risk-based Audit Plan for 2016- 
2019: 


document review; 

extensive data analysis with a focus on financial and human resources data; 
consultation with senior management and the Departmental Audit Committee; and 
consultation with Internal Audit staff and management. 


0. En Et SI 


The following sub-sections describe in more details these steps. 
3.3.1 Document Review 


In order to update the Risk-based Audit Plan for 2016-19, the audit team undertook a review of 
relevant documents to identify potential areas of high risk. The following documents were 
consulted: 


Fisheries and Oceans Canada’s Program Alignment Architecture and program descriptions; 
Fisheries and Oceans Canada’s Corporate Risk Profile; 

Sectors’ Risk Profiles and Programs’ Business Plans; 

Fisheries and Oceans Canada’s Management Accountability Framework assessment; 
Fisheries and Oceans Canada’s Departmental Performance Report; 

Fisheries and Oceans Canada’s Report on Plans and Priorities; 

Fisheries and Oceans Canada’s Evaluation Plan; 

Fisheries and Oceans Canada’s Environmental Scan; 

Fisheries and Oceans Canada’s Internal Audit and Evaluation Reports; 

Audit Reports from external assurance providers; and 

Fisheries and Oceans Canada’s departmental priorities. 
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In addition, the audit team considered all commitments and priorities identified in the Minister’s 
Mandate Letter issued in November 2015, as well as the planned audit engagements from 
external assurance providers. 


3.3.2 Data Analytics 


This year, extensive human resource and financial data analysis was completed for each Audit 
Universe Entity (AUE) to identify potential areas of risk. 


The analysis was derived from financial data extracted from the Management Reporting System 
and human resources data extracted from PeopleSoft by Human Resources Management Systems. 
The data included the three past fiscal years. 


Internal Audit Directorate 10 
Risk-based Audit Plan 2016-2019 


000012 


of the AUE in the Departments. Currently, 21 financial indicators and 28 human resources 
indicators were defined in consultation with the Office of the Comptroller General. The 
indicators were consistently calculated for each AUE. An overall financial risk rating and an 
overall human resources risk rating were also calculated for each AUE. 


This analysis helped identify areas of highest risks. 
3.3.3 Consultation process 


Consultations were held in September 2015 with the Deputy’s Management Committee (DMC) 
members. They were asked to comment on the audits planned for 2016-17 and 2017-18 as per 
the previous Risk-based Audit Plan and to discuss any particular sources of risk to which their 
organization was exposed. 


In addition, the external members of the Departmental Audit Committee were consulted through 
a conference call, and interviews were held with all DMC members, including Regional Directors 
General and Assistant Commissioner of the Canadian Coast Guard to discuss key risk areas. 


3.3.4 Identification of Areas with High Risk 


Building on last year’s risk assessment and taking into consideration the information obtained 
through the document review, data analysis and consultation process, a preliminary list of 
potential audit engagements was presented to the Departmental Audit Committee Chair for 
discussion and comments in December 2015 and subsequently to the Departmental Audit 
Committee members in February 2016. 


3.3.5 Priority Risk Assessment of the Auditable Entities 


Using all the information collected and analysed through the consultation, data analysis and 
document review process, the audit team assessed the risk likelihood and impact associated with 
each auditable entity within the audit universe. 


Taking into consideration the presence of risk factors and risk events, each entity was assigned a 
likelihood risk score. The audit team’s knowledge of the controls in place (if any) was also used 
for assigning a score for each proposed audit’s underlying entity. 


Risk factors include: 
o degree and recentness of change (e.g., changes to funding, personnel, new systems etc.); 


o degree of complexity (e.g., complexity of the entity in terms of its business processes, 
accountability structure, regulatory, legal and policy frameworks); 


o legislative or other compliance requirements (e.g., legal requirements and their impact 
should they not be met); 


o degree of dependencies (e.g., dependence on other groups or stakeholders). 
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3.3.6 Finalization of the Plan 


A Three-Year Plan was developed taking into consideration the following elements: 
o high risk areas; 
o resource requirements and availability; 
o other factors, such as: management priorities, planned evaluations, etc.; and 
o the need for the right balance between assurance and consulting services. 


The Three-Year Plan was presented for discussion at the Directors General - Management 
Committee meeting and the Deputy’s Management Committee meeting in January and February 
2016 respectively. A conference call with the Departmental Audit Committee members was also 
held in February 2016. Following these sessions some adjustments were made, and the final 
version of the Three-Year Audit Plan is provided in Section 4. 


3.4 APPROVAL OF THE RISK-BASED AUDIT PLAN 


The Risk-based Audit Plan is formally updated by the Internal Audit Directorate on an annual 
basis, reviewed by the Departmental Audit Committee and recommended for approval to the 
Deputy Minister. 


3.5 MONITORING OF THE RISK-BASED AUDIT PLAN 


The implementation of the Risk-based Audit Plan will be monitored on a regular basis throughout 
the year and regular status updates will be provided to the Departmental Audit Committee. 


If/when changes to the Risk-based Audit Plan are deemed necessary; the Internal Audit 
Directorate ensures that the principles of the audit planning process are observed and that all 
resulting decisions are well documented. By following a rigorous process, the Internal Audit 
Directorate can ensure that new decisions are being made in a consistent and timely manner. 
As mentioned previously, the Plan may be updated to address changes. These adjustments 
required to the Plan will be presented to the Departmental Audit Committee for 
recommendation to the Deputy Minister for approval. 


4.0 AUDIT PLAN SUMMARY 


4.1 2016-17 to 2018-19 PLANNED AUDIT WORK 


This section outlines the Risk-based Audit Plan for 2016-2019 and the proposed assurance and 
consulting engagements for the next three years. The engagements will employ audit assurance 
and consulting services that will evaluate the systems of internal control in relation to 
established criteria. 


For year one of the Plan, preliminary audit objectives and scope, as well as resource 
requirements have been identified. In addition, prior to commencing each proposed 
engagement, a more detailed risk assessment will be performed to refine the proposed scope 
and objective to help ensure it addresses the most significant risks. For years two and three of 
the Plan, only areas of risk are described. Given the constant evolution of the operating and risk 
environment, audit project realignment based on a Fisheries and Oceans Canada updated risk 


Internal Audit Directorate 12 
Risk-based Audit Plan 2016-2019 


000014 


Act / Document div 
de la Loi sur l'accës 
assessment is expected at the next Risk-based Audit Plan update. Preliminary audit objectives 
and scope as well as resources requirement will be determined at that point. 


It should be noted that this Plan is not a budget document and any indication of resource 
estimates are included only as a reference to the expected level of effort required to complete 
the engagements identified in the Plan. While it is estimated that the proposed Plan can be 
accomplished within the budgeted resources (salary, operations and maintenance) allocated for 
the Internal Audit Directorate, the reader is cautioned that retention levels and recruitment 
efforts may affect the progress against the Plan in the next three-year period. The Internal 
Audit Directorate may have to supplement with contracted resources as required. 


The table, starting on the next page, summarizes the proposed audit engagements for 2016- 
2019. 
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5.0 AUDIT RESOURCES 


3.1 SUMMARY OF RESOURCE AVAILABILITY AND CAPACITY 


In 2016-17, the internal audit function will be delivered through 20 full-time equivalents 
(forecast utilization). The following table summarizes the planned resources utilization for 
2016-17 by activity: 


Planned Resources Utilization for 2016-17 Full-Time Equivalent 
- Estimates * 
Internal Audit (Assurance and Consulting Engagements) as per 12.74 
Risk-based Audit Plan i 
Corporate Activities 0.87 
Risk-based Audit Plan 0.79 
Quality Assurance and Improvement Program 1.20 
External Liaison 0.61 
Support to Departmental Audit Committee 0.49 
Human Resources, Finances, Administrative and Support 0.12 
Services i 
Strategic Corporate Planning and Reporting 0.91 
Branch Management 0:57 
Data Analytics 0.19 
Language Training 1.03 
Total 19.52 


In preparing the Risk-based Audit Plan, an estimate of total resource capacity available was 
determined and used for scheduling audits. Taking into account the budget available for 
internal resources, a total of approximately 1,665 person-days of capacity for 13 auditors to 
conduct actual audit engagements was estimated for 2016-17. This is direct audit project 
time. 


Resource capacity was determined taking into consideration the current staffing level and 
planned staffing actions. That being said, it should be noted that with the planned staffing 
actions, it is anticipated that the internal audit function will be eventually delivered through 
23 FTES. 


* The numbers presented are estimated. 


5.2 STATEMENT ON THE ADEQUACY OF RESOURCES 


Planned Audit work for fiscal year 2016-17, summarizes the estimated internal resources, 
contractor and travel costs required for each audit in 2016-17. The number of internal 
resources person-days estimated to perform the planned engagements for 2016-17 is 1,665. 
All 1,665 will be dedicated to assurance and consulting engagements. 


The resource needs are adequately covered by the Internal Audit Directorate’s full-time 
equivalents while allowance is made for management action plan follow-up activities, liaison 
with the Office of the Auditor General and other central agencies, support to the 
Departmental Audit Committee, quality assurance and improvement program, professional 
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practices, administrative support, leave and training. Should the Internal Audit Directorate 
budget in future years remain comparable, it is expected that resources will be adequate for 
2017-18 and 2018-19. 


In addition, the Internal Audit Directorate possesses the knowledge and competency required 
to carry out the audit engagements included in the Risk-based Audit Plan. The majority of 
the Internal Audit Directorate Staff possess a Certified Internal Auditor (CIA), Certified 
Government Auditing Professionals (CGAP), Certification in Risk Management Assurance 
(CRMA) and/or Certified Information Systems Auditor (CISA) designation. In addition, several 
employees have experience and received training in the use of Audit Command Language 
(ACL), a data analysis software. Several employees have accounting designations and some 
have a Certified Fraud Examiner (CFE) certification. Although the Internal Audit Directorate 
possesses a broad competency categories, in the case where a specific expertise is required 
and not available in-house, internal audit resources may be supplemented by external 
resources as required. 


6.0 SUMMARY OF AUDIT COVERAGE 


APPENDIX A - COVERAGE OF PROGRAM ALIGNMENT ARCHITECTURE 

Appendix A summarizes audit coverage of the audit universe by Program Activity. 
Appendix B summarizes recent and on-going external audits. 

APPENDIX C - COVERAGE OF DEPARTMENTAL PRIORITIES 


Appendix C summarizes audit coverage of the departmental priorities. Some audit 
engagements address more than one departmental priority. 


APPENDIX D - COVERAGE BY AGENCY/SECTOR 


Appendix D summarizes audit coverage by Sector/Agency. 


7.0 APPROVALS 


The Risk-based Audit Plan was presented at the Departmental Audit Committee on 
March 11, 2016. The Plan was recommended for approval by the Departmental Audit 
Committee and approved by the Deputy Minister. 


w 
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FOREWORD 


This document contains the final draft three-year Risk-Based Audit Plan from 2017-18 to 2019-20 for 
Fisheries and Oceans Canada. 


This Plan is presented to the Departmental Audit Committee for review and recommendation for 
approval by the Deputy Minister. In addition, the Plan will be updated as required based on an 
assessment of current risks and therefore, further changes may occur, and the timing or scope of some 
engagements may change. These adjustments and changes required to the Plan will be presented to the 
Departmental Audit Committee for recommendation to the Deputy Minister for approval. 
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1.0 INTRODUCTION 


Fisheries and Oceans Canada is responsible for developing and implementing policies and programs in 
support of Canada’s scientific, ecological, social and economic interests in oceans and freshwaters. The 
Canadian Coast Guard, a Special Operating Agency within Fisheries and Oceans Canada, is responsible 
for services and programs that contribute to the safety, security and accessibility of Canada’s 
waterways. The Canadian Coast Guard also contributes to the objectives of other government 
organizations through the provision of a civilian fleet and a broadly distributed shore-based 
infrastructure. 


The Department guiding legislation includes the Fisheries Act, which confers responsibility to the 
Minister for the management of fisheries, habitat and aquaculture and the Oceans Act, which charges 
the Minister with leading oceans management and providing Canadian Coast Guard and hydrographic 
services on behalf of the Government of Canada. The Department also shares, with Environment Canada 
and Parks Canada, responsibility for the Species at Risk Act, which charges the Minister with the 
responsibilities associated with the management of aquatic species at risk in Canada. 


Fisheries and Oceans Canada’s Internal Audit Directorate plays an important role in supporting the 
Department e operations by providing assurance and consulting services in relation to all important 
aspects of departmental strategies, systems, practices and management control frameworks consisting 
of governance, risk management, and internal controls. Where control weaknesses exist and where the 
achievement of Fisheries and Oceans Canada’s objectives may be at risk, the Internal Audit Directorate 
plays a role in providing constructive insight and recommendations for the strengthening of 
departmental operations. In this way, the Internal Audit Directorate contributes to enhanced 
departmental accountability and performance. 


The Government of Canada’s Standards for the professional practice of internal audit are based on the 
International Standards for the Professional Practice of Internal Audit prescribed by the Institute of 
Internal Auditors. The Standards stipulate that the role of internal audit is to provide assurance that the 
system of internal control is adequate and effective to manage risk at a level that is acceptable to 
management. 


The internal audit function in the federal government is guided by the 2012 Treasury Board (TB) Policy 
on Internal Audit. The objective of this policy is to contribute to the improvement of public sector 
management by ensuring a strong, credible, effective and sustainable internal audit function within 
departments as well as government-wide. The expected results of the Policy on Internal Audit include 
the following: 

o Deputy heads are effectively supported in their role of accounting officer by a strong, credible 
internal auditing regime that contributes directly to sound risk management, control and 
governance; and is independent from line management. 

° Deputy heads are provided with independent assurance from internal audit, and advice from 
the Audit Committee, regarding the effectiveness of risk management, control and governance 
processes, at the departmental level and the Comptroller General is provided with the same at 
the government-wide level. 


In line with the TB Policy on Internal Audit and supporting TB Directive on Internal Auditing in the 
Government of Canada, the main objectives of the internal audit function and the Chief Audit Executive 
include: 
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° Providing independent, objective assurance to senior management on the adequacy and 
effectiveness of risk management, control, and governance processes within the Department. 

o Establishing and updating at least annually a multi-year plan of internal audit engagements 
based ona risk assessment and which is focused predominantly on the provision of assurance 
services. 


o Coordinating internal auditing activities and plans with other assurance providers to minimize 
duplication of effort and demands on departmental management. 

° Communicating the plan of engagements and resource requirements for the internal audit 
function, including any variances to this plan and the impact of resource limitations to the 
Deputy Head and the Audit Committee. 

° Ensuring that internal audit resources are appropriate and effectively deployed to achieve the 
approved plan. 

o Ensuring the timely completion of internal audit engagements, including horizontal audits led by 
the Comptroller General. 


o Ensuring that internal audit engagement reports are provided to the Audit Committee in a 
timely manner. 


o Reporting to the Audit Committee on whether management's action plans have been 
implemented. 

o Ensuring that internal auditors have appropriate professional qualifications and skills and 
opportunities to maintain and develop their internal auditing competence. 


° Developing and maintaining a quality assurance and improvement program that covers all 
aspects of the internal audit function and continuously monitoring its effectiveness, including 
ensuring that a practice inspection of the internal audit function is conducted at least every five 
years, by a qualified independent reviewer competent in the professional practice of internal 
auditing and the external assessment process. 

o Ensuring that the Internal Auditing Standards for the Government of Canada are followed. 


° Providing an annual report to the Deputy Head and the Departmental Audit Committee. 


This three-year Risk-Based Audit Plan is a key component of a rigorous audit regime delivered by 
qualified audit professionals that contributes to the effectiveness of governance, risk management and 
internal controls over the delivery of Fisheries and Oceans Canada’s programs and corporate activities. 


1.1 BACKGROUND 


The development of the Risk-Based Audit Plan is consistent with the requirements of the Treasury Board 
Policy on Internal Audit, and the Plan is based on an assessment of risks that could adversely affect 
Fisheries and Oceans Canada. A collaborative and consultative approach has been used to identify and 
assess the most significant risks faced by the Department. This included the consultation of several 
internal and external sources of information as well as consultations with the members of the Executive 
table. 


In developing the Risk-Based Audit Plan for 2017-2020, the Internal Audit Directorate took into 
consideration the economic environment in which the Department is operating and the 
transformational changes it is implementing, including the revised priorities identified in the Minister's 
Mandate Letter issued in November 2015, and the recent launch of the $1.5 billion national Oceans 
Protection Plan, which is aimed to protect Canada’s coasts and waterways, and improve marine safety. 
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1.2 PURPOSE 


This document, developed by the Internal Audit Directorate, outlines the Risk-Based Audit Plan for 

Fisheries and Oceans Canada. The Risk-Based Audit Plan has been designed with the objective of: 

° identifying the priorities of the internal audit activity based on an assessment of risk and potential 
exposure that may affect Fisheries and Oceans Canada entities’ ability to accomplish their 
objectives; 

° coordinating activities with external assurance service providers and ensuring that government-wide 
audits led by the Comptroller General are taken into account to ensure proper coverage and 
minimize duplication of effort; 

° ensuring the provision of services that are predominantly assurance-based; and 

° allocating internal audit resources to those areas that represent the highest risk and significance and 
ensuring that sufficient work is completed to support an annual overview report of aggregated 
findings. 


The Plan provides the Deputy Minister, the Executive Table and the Departmental Audit Committee with 
a detailed schedule of planned activities for 2017-18 and an overview of potential areas for audit 
engagements for the following two years. 


This Plan includes the following sections: 
o Internal Audit Directorate (Section 2) 
Approach/Methodology (Section 3) 


o Audit Plan Summary (Section 4) 
o Audit Resources (Section 5) 
o Summary of Audit Coverage (Section 6) 


2.0 INTERNAL AUDIT DIRECTORATE 


2.1 ORGANIZATION 


The Department’s internal audit activity is led by the Chief Audit Executive who reports directly to the 
Deputy Minister. The Chief Audit Executive is responsible for establishing a multi-year Risk-Based Audit 
Plan consistent with the Department e objectives and priorities, and for maintaining a quality assurance 
and improvement program to monitor the Internal Audit Directorate’s effectiveness. The Chief Audit 
Executive is also responsible for ensuring internal audit resources are professionally qualified and 
appropriately trained. In addition, the Chief Audit Executive communicates relevant information, 
including internal audit findings, to senior management, the Departmental Audit Committee, the Deputy 
Minister and, as appropriate, the Office of the Comptroller General. 


The Internal Audit Directorate consists of two distinct but complementary functions namely Internal 
Audit Services and Professional Practices, led by a senior director and a director respectively, both 
reporting to the Chief Audit Executive. The Internal Audit Services function is responsible for providing 
assurance and consulting services while the Professional Practices function supports the internal audit 
activity and is responsible for the quality assurance and improvement program, external audit liaison 
services and the Departmental Audit Committee secretariat. 
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2.2 DEPARTMENTAL AUDIT COMMITTEE 


The Departmental Audit Committee is an essential part of the Department’s governance structure and 
of the audit regime established by the TB Policy on Internal Audit. The Departmental Audit Committee 
provides the Deputy Minister with independent, objective advice, guidance and assurance on the 
adequacy of the Department’s risk management, controls, governance processes and audit capacity. 


In order to fulfill its role, the Departmental Audit Committee is responsible to review a number of 
documents prepared by the Internal Audit Directorate, and to recommend their approval to the Deputy 
Minister. These documents include: 
o adepartmental internal audit charter; 
o the multi-year Risk-Based Audit Plan; and 
o internal audit reports and corresponding management action plans to address 
recommendations. 


In addition, the Departmental Audit Committee is responsible to: 

° review regular reports on progress against the Risk-Based Audit Plan; 

o provide advice to the Deputy Head on the sufficiency of resources of the internal audit function; 

© monitor and assess the performance of the internal audit function; 

° provide advice to the Deputy Head on the recruitment and appointment, as well as on the 
performance, of the Chief Audit Executive; and 

o ensure they are made aware of internal audit engagements or tasks that do not result in a 
report to the Committee, and be informed of all matters of significance arising from such work. 


The Departmental Audit Committee is composed of the Deputy Minister, the Associate Deputy Minister 
and three external members. The Committee is chaired by one external member. In addition, the 
Commissioner of the Canadian Coast Guard, the Chief Financial Officer, the Senior General Counsel, the 
Assistant Deputy Minister Human Resources & Corporates Services and the Chief Audit Executive are 
permanent observers of the Departmental Audit Committee. 


2.3 RESOURCES 

The total budget (salary, operations and maintenance funding) of the Internal Audit Directorate for fiscal 
year 2017-18 will be approximately $2.5 million. With the planned staffing actions, it is anticipated that 
the internal audit function will be delivered through 22 full-time equivalents in 2017-18. 

2.4 INTERNAL AUDIT SERVICES 

Internal audit takes a disciplined, evidence-based approach to provide assurance that key systems and 
processes are appropriately designed and are functioning as intended. As a complement to its assurance 


role, and within its sphere of expertise, the Internal Audit Directorate also provides consulting services. 


This Risk-Based Audit Plan factors in the needs for consulting services to best support management 
while maintaining Internal Audit’s objectivity. 


Sections 2.4.1 and 2.4.2 describe the various assurance and consulting services provided by the Internal 
Audit Directorate. 
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2.4.1 Assurance Services (Internal Audits and Reviews) 

Planned Internal Audits 

Provides reasonable assurance against defined criteria, following professional internal auditing 
standards, and assurance standards. Scope is defined via a formal planning phase that includes a 
comprehensive risk assessment of the entity being audited. Areas selected for audit are based on an 
annual risk based planning exercise. 

Directed Internal Audits 

Provides reasonable assurance in response to ad-hoc request(s) made by the DM, DMA, Commissioner, 
DCs, ADMs or DAC in response to accountability concerns in a particular area. Scope is defined via a 
formal planning phase that includes a comprehensive risk assessment of the entity being audited. 
Review 

Provides an objective assessment of a particular area without the same rigour or examination and/or 
testing of an audit. While not designed to provide reasonable assurance, it can provide management 
with moderate assurance. May be requested by management or initiated by the IAD. 

Continuous Audit 

Provides ongoing and independent assessments of control frameworks and risk management systems. 
By utilizing a methodology or a framework that employs audit testing procedures, which can be 
combined with automated tools (for data extraction and analysis), it provides assurance on financial and 
non-financial data. 

2.4.2 Consulting Services 

Control / Risk Assessment 

Provides a detailed control/risk assessment of a particular area and a preliminary assessment of 
established control processes. The control/risk assessment may lead to recommendations or may then 
be used to inform additional work which may be required (internal or external). 

Advice 

Encompasses formal and informal advisory services, which may be planned or ad hoc. May be requested 
by management or initiated by the IAD. Scope may include identification of control weaknesses and/or 
significant accountability risks. 


Other Engagements 


Formal engagement requested by management who play a major role in defining objective and scope. 
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2.5 Professional Practices 
2.5.1 Quality Assurance and Improvement Program 


Pursuant to the Treasury Board Policy on Internal Audit, the Government of Canada adopted the 
Institute of the Internal Auditors International Professional Practices Framework and the International 
Standards for the Professional Practice of Internal Audit as part of the Government of Canada Internal 
Audit Standards. As part of the Standards, the Chief Audit Executive is responsible to develop and 
maintain a quality assurance and improvement program, including the conduct of an external quality 
assessment of the internal audit function at least every five years. 


The quality assurance and improvement program activities also include an internal quality assessment of 
all phases of an audit. To complement its quality assessment activities at the audit engagement level, 
the Directorate performs internal assessments at the audit function level. The last assessment was 
performed during Summer 2015 in preparation of the external practice inspection. 


The Internal Audit Directorate had an external practice inspection conducted during the Fall of 2015. 
Consequently, the IA Activity was found to be Generally Conforming to the requirements of the TB Policy 
on Internal Audit and the associated Directive, the Government of Canada IA Standards and the IIA 
Standards. 


2.5.2 Liaison with the Office of the Auditor General and other External Assurance Providers 


The Internal Audit Directorate’s management of liaison activities with the Office of the Auditor General, 
the Office of the Comptroller General, and other external assurance providers helps ensure that the 
activities of the Department are represented accurately, fairly and in a balanced manner. Various 
activities are carried out to ensure positive working relationships and effective coordination of all 
external audit work. Specifically, this includes providing assistance to departmental officials throughout 
the conduct of audits, negotiating acceptable timeframes for providing requested material, as well as 
collaborating with others when validating the factual content of audit reports and preparing 
departmental responses. 


In addition, ministerial responses to petitioners with regards to environmental petitions are coordinated 
with the appropriate Agency/Sectors. 


2.5.3 Follow-up on Management Action Plans 


The Internal Audit Directorate actively and vigorously monitors and reports on the implementation of 
approved Management Action Plans to address internal audit recommendations, as well as 
recommendations stemming from external audits performed by the Office of the Auditor General and 
other external assurance providers. As part of the follow-up process, the Internal Audit Directorate 
requests updates from management, assesses and validates corrective measures that have been taken 
and determines whether the actions carried out are appropriate. 


The Internal Audit Directorate has a strong follow-up process. Status updates are requested on a semi- 
annual basis from the auditees and a summary is presented at the Departmental Audit Committee 
meeting for approval. The process also involves assessing the risks associated with delays in 
implementation. When the implementation of a Management Action Plan is delayed, the representative 
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from the relevant Agency/Sector is required to attend the Departmental Audit Committee meeting to 
explain the reasons for the delays and to request an extension. 


When there is a high risk that the corrective actions may not be completed as reported by the auditee, 
the Internal Audit Directorate may conduct a more comprehensive follow-up audit. Follow-up audit 
reports are tabled and approved at the Departmental Audit Committee and posted on the Directorate 
internet site and provided to the Office of the Comptroller General, as for regular internal audit 
engagements. 


2.5.4 Departmental Audit Committee Secretariat 


The Internal Audit Directorate provides administrative and logistical support to the Departmental Audit 
Committee members in order to coordinate and organize the meetings. This includes the preparation of 
the Committee meeting agenda, and the collecting and assembling of meeting material into electronic 
binders for submission to Departmental Audit Committee members two weeks in advance of each 
meeting. The Internal Audit Directorate also provides support for the preparation of the Departmental 
Audit Committee Annual Work Plan and Report. 


2.5.5 Liaison with the Office of the Comptroller General and participation in their Horizontal 
Internal Audits 


As outlined in the Treasury Board Policy on Internal Audit, the Internal Audit Directorate must consider 
government-wide audits led by the Comptroller General when developing the Risk-Based Audit Plan. 
Horizontal audits planned by the Office of the Comptroller General were taken into account in the 2017- 
2020 Risk-Based Audit Plan. 


The Office of the Comptroller General has adopted a collaborative approach in conducting horizontal 
internal audits by sharing the work between the Office of the Comptroller General and the Internal 
Audit groups in departments. When conducting a horizontal audit in large departments and agencies, 
the Office of the Comptroller General performs the planning of the audit and prepares the audit work 
programs including the steps to take for documentation review and interview questionnaires. The Office 
of the Comptroller General then requires the Internal Audit Directorate of the participating departments 
to provide audit resources (normally one or two) to complete the examination phase. Each department 
may decide to expand the scope of a horizontal audit to address matters of significance specific to their 
department. 


3.0 APPROACH/METHODOLOGY 


3.1 PLANNING PROCESS 


This Plan represents an update of the Risk-Based Audit Plan for 2016-2019 that was supported by the 
Departmental Audit Committee and approved by the Deputy Minister in March 2016. 


The Risk-Based Audit Plan for 2017-2020 was developed in accordance with the Treasury Board Policy on 
Internal Audit. The procedures taken to develop the 2017-2020 Risk-Based Audit Plan were based on the 
Office of the Comptroller General Practice guidebook entitled “Internal Audit Planning for Departments 
and Agencies” as well as best practices/areas of improvement found during last year’s update. Fisheries 
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and Oceans Canada’s 2016-17 Program Alignment Architecture was used to develop the audit universe. 
This universe represents the inventory of auditable entities in the department organized by strategic 
outcome. 


Building on last year’s assessment and process, the internal audit team undertook the following 
activities to identify high-risk areas and subsequently develop the Risk-Based Audit Plan for 2017-2020: 


o defining the audit universe; 

o document review; 

° consultation with senior management and the Departmental Audit Committee; and 
o consultation with Internal Audit staff and management. 


The following sub-sections describe in more details these steps. 
3.1.1 Audit Universe 


The Department s activities are organized under three strategic outcomes: 
o Economically Prosperous Maritime Sectors and Fisheries; 
o Sustainable Aquatic Ecosystems; and 
o Safe and Secure Waters. 


These strategic outcomes are the basis of the Department’s Program Alignment Architecture for 2016- 
17. The Program Alignment Architecture is an inventory of all the programs and activities undertaken by 
the Department. The Program Alignment Architecture was a major input into the definition of the audit 
universe which forms the basis for selecting areas to audit, defines the potential scope of the internal 
audit activity and is comprised of major auditable units that may be subject to audit. It is the starting 
point of the Risk-Based Audit Plan. 


3.1.2 Document Review 


In order to update the Risk-Based Audit Plan for 2017-2020, the audit team undertook a review of 
relevant documents to identify potential areas of high risk. The following documents were consulted: 


o Fisheries and Oceans Canada’s Program Alignment Architecture and program descriptions; 
Fisheries and Oceans Canada’s Corporate Risk Profile; 

Sectors’ Risk Profiles and Programs’ Business Plans; 

Fisheries and Oceans Canada’s Management Accountability Framework assessment; 
Fisheries and Oceans Canada’s Departmental Performance Report; 

Fisheries and Oceans Canada’s Report on Plans and Priorities; 

Fisheries and Oceans Canada’s Evaluation Plan; 

Fisheries and Oceans Canada’s Environmental Scan; 

Fisheries and Oceans Canada’s Internal Audit and Evaluation Reports; 

Audit Reports from external assurance providers; and 
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Fisheries and Oceans Canada’s departmental priorities. 
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In addition, the audit team considered all commitments and priorities identified in the Minister's 
Mandate Letter issued in November 2015, as well as the planned audit engagements from external 
assurance providers. 


3.1.3 Consultation process 


Consultations were held in the Fall 2016 with all members of the Executive Table, as well as key 
Directors General and Assistant Commissioners of the CCG. They were asked to comment on the audits 
planned for 2017-20 and to discuss any particular sources of risk to which their organization was 
exposed. 


3.1.4 Priority Risk Assessment of the Auditable Entities 


Using all the information collected and analysed through the consultation and document review 
process, the audit team assessed the risk likelihood and impact associated with each auditable entity 
within the audit universe. 


Taking into consideration the presence of risk factors and risk events, each entity was assigned a 
likelihood risk score. The audit team's knowledge of the controls in place (if any) was also used for 
assigning a score for each proposed audit's underlying entity. 


Risk factors include: 
o degree and recentness of change (e.g., changes to funding, personnel, new systems etc.); 


o degree of complexity (e.g., complexity of the entity in terms of its business processes, 
accountability structure, regulatory, legal and policy frameworks); 


o legislative or other compliance requirements (e.g., legal requirements and their impact should 
they not be met); 


o degree of dependencies (e.g., dependence on other groups or stakeholders). 


3.1.5 Finalization of the Plan 


A Three-Year Plan was developed taking into consideration the following elements: 
° high risk areas; 
o resource requirements and availability; 
o other factors, such as: management priorities, planned evaluations, etc.; and 
o the need for the right balance between assurance and consulting services. 


The Three-Year Plan was provided to the Directors General - Management Committee meeting and the 
members of the Executive Table in January and February 2017 respectively. A meeting with the 
Departmental Audit Committee Chair was held in January 2017. In addition, a conference call with the 
Departmental Audit Committee members was also held in March 2017. Following these sessions some 
adjustments were made, and the final version of the Three-Year Audit Plan is provided in Section 4. 
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3.2 APPROVAL OF THE RISK-BASED AUDIT PLAN 


The Risk-Based Audit Plan is formally updated by the Internal Audit Directorate on an annual basis, 
reviewed by the Departmental Audit Committee and recommended for approval to the Deputy Minister. 


3.3 MONITORING OF THE RISK-BASED AUDIT PLAN 


The implementation of the Risk-Based Audit Plan will be monitored on a regular basis throughout the 
year and regular status updates will be provided to the Departmental Audit Committee. 


If/when changes to the Risk-Based Audit Plan are deemed necessary; the Internal Audit Directorate 
ensures that the principles of the audit planning process are observed and that all resulting decisions are 
well documented. By following a rigorous process, the Internal Audit Directorate can ensure that new 
decisions are being made in a consistent and timely manner. 

As mentioned previously, the Plan may be updated to address changes. These adjustments required to 
the Plan will be presented to the Departmental Audit Committee for recommendation to the Deputy 
Minister for approval. 


4.0 AUDIT PLAN SUMMARY 


4.1 2017-18 to 2019-20 PLANNED AUDIT WORK 


This section outlines the Risk-Based Audit Plan for 2017-2020 and the proposed assurance and 
consulting engagements for the next three years. The engagements will employ audit assurance and 
consulting services that will evaluate the systems of internal control in relation to established criteria. 


For year one of the Plan, preliminary audit objectives and scope, as well as resource requirements have 
been identified. In addition, prior to commencing each proposed engagement, a more detailed risk 
assessment will be performed to refine the proposed scope and objective to help ensure it addresses 
the most significant risks. For years two and three of the Plan, only areas of risk are described. Given the 
constant evolution of the operating and risk environment, audit project realignment based ona 
Fisheries and Oceans Canada updated risk assessment is expected at the next Risk-Based Audit Plan 
update. Preliminary audit objectives and scope as well as resource requirements will be determined at 
that point. 


It should be noted that this Plan is not a budget document and any indication of resource estimates are 
included only as a reference to the expected level of effort required to complete the engagements 
identified in the Plan. While it is estimated that the proposed Plan can be accomplished within the 
budgeted resources (salary, operations and maintenance) allocated for the Internal Audit Directorate, 
the reader is cautioned that retention levels and recruitment efforts may affect the progress against the 
Plan in the next three-year period. The Internal Audit Directorate may have to supplement with 
contracted resources as required. 
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Document Released Under the Access to 
Information Act / Document divulgué en vertu 
de la Loi sur l'accès à l'information. 


The table below summarizes the proposed audit engagements for 2017-2020. 


Proposed list of Internal Audit Engagements for FY 2017-2020 


à 
6 Audit of Compliance and Enforcement EFM 
1 Audit of Indigenous Partnerships EFM, CFO 

Audit of the Incident Command System CCG 


Audit of Grants and Contributions* CFO 


4 | Audit on the use of Science in decision-making EFM, Strategic Policy 
Audit of Inventory Management CFO 
e | Audit of Aquatic Invasive Species EFM 


Acronyms: 

CCG: Canadian Coast Guard 

CFO: Chief Financial Officer 

EFM: Ecosystems and Fisheries Management 
EOS: Ecosystems and Oceans Science 

HRCS: Human Resources and Corporate Services 
TBD: To be determined 


*|tis currently anticipated that this engagement be conducted in Q4 of 2019-2020. However, the timing 
of this engagement will be reassessed annually as part of the Risk-Based Audit Plan update to determine 
whether it should be postponed to 2020-2021. 


= 
= 
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5.0 AUDIT RESOURCES 


5.1 SUMMARY OF RESOURCE AVAILABILITY AND CAPACITY 


In 2017-18, the Internal Audit Function will be delivered through 22 full-time equivalents (FTEs). The 
following table summarizes the planned resource utilization by activity: 


Planned Resources Utilization for 2017-18 Full-Time Equivalent — 
Assurance and Consulting Engagements as per RBAP 12.0 
Corporate Activities 1.5 
Risk-Based Audit Plan 0.8 
External Liaison 1.0 
Support to Departmental Audit Committee 0.8 
Human Resources, Finances, Administrative and Support Services 2.1 
Strategic Corporate Planning and Reporting 0.5 
Branch Management 1.4 
Data Analytics 0.0 
Language Training 0.6 
Total 22.0 


Resource capacity was determined taking into consideration the current staffing level and planned 
staffing actions. That being said, it should be noted that with the planned staffing actions, it is 
anticipated that the Internal Audit Function will eventually be delivered through 22 FTEs. 


* The numbers presented are estimated. 


5.2 STATEMENT ON THE ADEQUACY OF RESOURCES 


Planned Audit work for fiscal year 2017-18, summarizes the estimated internal resources, contractor 
and travel costs required for each audit in 2017-18. 


The resource needs are adequately covered by the Internal Audit Directorate’s full-time equivalents 
while allowance is made for management action plan follow-up activities, liaison with the Office of the 
Auditor General and other central agencies, support to the Departmental Audit Committee, quality 
assurance and improvement program, professional practices, administrative support, leave and training. 
Should the Internal Audit Directorate budget in future years remain comparable, it is expected that 
resources will be adequate for 2018-19 and 2019-20. 


In addition, the Internal Audit Directorate possesses the knowledge and competency required to carry 
out the audit engagements included in the Risk-Based Audit Plan. The majority of the Internal Audit 
Directorate Staff possess a Certified Internal Auditor (CIA), Certified Government Auditing Professionals 
(CGAP) and/or Certification in Risk Management Assurance (CRMA). In addition, several employees have 
experience and received training in the use of Audit Command Language (ACL), a data analysis software. 
Several employees have accounting designations and some have a Certified Fraud Examiner (CFE) 
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certification. Although the Internal Audit Directorate possesses a broad range of competencies, in the 
case where a specific expertise is required and not available in-house, internal audit resources may be 
supplemented by external resources as required. 


6.0 SUMMARY OF AUDIT COVERAGE 


APPENDIX A- COVERAGE OF PROGRAM ALIGNMENT ARCHITECTURE 


Appendix A summarizes audit coverage of the audit universe by Program Activity. 


APPENDIX B - RECENT AND ONGOING EXTERNAL AUDITS 
Appendix B summarizes recent and on-going external audits. 


APPENDIX C- COVERAGE OF DEPARTMENTAL PRIORITIES 


Appendix C summarizes audit coverage of the departmental priorities. Some audit engagements address 
more than one departmental priority. 


APPENDIX D- COVERAGE BY AGENCY/SECTOR 


Appendix D summarizes audit coverage by Sector/Agency. 


7.0 APPROVALS 


The Risk-Based Audit Plan was presented at the Departmental Audit Committee on 
March 10, 2017. The Plan was recommended for approval by the Departmental Audit Committee and 
approved by the Deputy Minister. 


+ 
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FOREWORD 


This document contains the final Risk-Based Audit Plan from 2018-19 to 2019-20 for Fisheries and 
Oceans Canada. 


This Plan is presented to the Departmental Audit Committee for review and recommendation for 
approval by the Deputy Minister. The Plan may be updated during the year, as required, based on an 
assessment of risks. As such, the timing or scope of some engagements may change. Any adjustments or 
changes will be presented to the Departmental Audit Committee for recommendation to the Deputy 
Minister for approval. 
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1.0 INTRODUCTION 


Fisheries and Oceans Canada is responsible for developing and implementing policies and programs in 
support of Canada’s scientific, ecological, social and economic interests in oceans and freshwaters. The 
Canadian Coast Guard, a Special Operating Agency within Fisheries and Oceans Canada, is responsible 
for services and programs that contribute to the safety, security and accessibility of Canada’s 
waterways. The Canadian Coast Guard also contributes to the objectives of other government 
organizations through the provision of a civilian fleet and a broadly distributed shore-based 
infrastructure. 


The Department e guiding legislation includes the Fisheries Act, which confers responsibility to the 
Minister for the management of fisheries, habitat and aquaculture and the Oceans Act, which charges 
the Minister with leading oceans management and providing Canadian Coast Guard and hydrographic 
services on behalf of the Government of Canada. The Department also shares, with Environment Canada 
and Parks Canada, responsibility for the Species at Risk Act, which charges the Minister with the 
responsibilities associated with the management of aquatic species at risk in Canada. 


Fisheries and Oceans Canada’s Internal Audit Directorate plays an important role in supporting the 
Department’s operations by providing assurance and consulting services in relation to all important 
aspects of departmental strategies, systems, practices and management control frameworks consisting 
of governance, risk management, and internal controls. Where control weaknesses exist and where the 
achievement of Fisheries and Oceans Canada’s objectives may be at risk, the Internal Audit Directorate 
plays a role in providing constructive insight and recommendations for the strengthening of 
departmental operations. In this way, the Internal Audit Directorate contributes to enhanced 
departmental accountability and performance. 


The Government of Canada’s Standards for the professional practice of internal audit are based on the 
International Standards for the Professional Practice of Internal Audit prescribed by the Institute of 
Internal Auditors. The Standards stipulate that the role of internal audit is to provide assurance that the 
system of internal control is adequate and effective to manage risk at a level that is acceptable to 
management. 


The internal audit function in the federal government is guided by the 2017 Treasury Board (TB) Policy 
on Internal Audit. The objective of this policy is to ensure that the oversight of public resources 
throughout the federal public administration is informed by a professional and objective internal audit 
function that is independent of departmental management. The expected results of the Policy on 
Internal Audit include the following: 

o Deputy heads are supported in their role as accounting officer, as defined in section 16.4 (1) and 
16.4 (2) of the Financial Administration Act , by an internal audit function that contributes 
directly and proactively to improving risk management, control and governance; and 

o Deputy heads receive assurance and advice from their Departmental Audit Committees and 
internal audit function to inform decision making in their departments. 


In line with the TB Policy on Internal Audit and supporting TB Directive on Internal Audit the main 
responsibilities of the internal audit function and the Chief Audit Executive include: 
o Applying the Institute of Internal Auditors’ International Professional Practices Framework in the 
department, unless the framework is in conflict with the Treasury Board Policy on Internal Audit 
or its directive; if there is a conflict, the policy or directive will prevail; 
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o Establishing at least annually, and updating as required, a departmental risk-based audit plan 
that: spans multiple years; focuses primarily on providing assurance services; is recommended 
by the Departmental Audit Committee and approved by the deputy head; and which considers 
the following: 

o Departmental areas of high risk and significance; 

o Horizontal audits led by the Comptroller General; 

o Planned audits led by external assurance providers and other departments as 
appropriate; and 

o Other oversight engagements, including, where the necessary expertise and capacity are 
in place, the option to provide consulting services to the organization, as a supplement 
to the assurance role and in accordance with the Institute of Internal Auditors’ 
International Professional Practices Framework. 

o Ensuring that the deputy head and the Departmental Audit Committee are aware of the 
resource requirements for the internal audit function and the impact of resource decisions; 


o Ensuring the timely completion of internal audit engagements; 


° Reporting at least annually to the deputy head on whether the actions scheduled by 
management in response to audit recommendations, both internal and external, have been 
implemented; and 

o Ensuring that internal auditors have the appropriate qualifications, skills, and opportunities to 
maintain and develop their internal auditing competencies. 


This Risk-Based Audit Plan is a key component of a rigorous audit regime delivered by qualified audit 
professionals that contributes to the effectiveness of governance, risk management and internal 
controls over the delivery of Fisheries and Oceans Canada’s programs and corporate activities. 


1.1 BACKGROUND 


The development of the Risk-Based Audit Plan is consistent with the requirements of the Treasury Board 
Policy on Internal Audit, and the Plan is based on an assessment of risks that could adversely affect 
Fisheries and Oceans Canada. A collaborative and consultative approach has been used to identify and 
assess the most significant risks faced by the Department. This included the consultation of several 
internal and external sources of information as well as consultations with the members of the Executive 
table. 


In developing the Risk-Based Audit Plan for 2018-2020, the Internal Audit Directorate took into 
consideration the current environment in which the Department is operating and the transformational 
changes it is implementing, including (but not limited to) the priorities identified in the Minister’s 
Mandate Letter issued in August 2016, the launch of the $1.5 billion national Oceans Protection Plan, as 
well as the implementation of Comprehensive Review. 


1.2 PURPOSE 


This document, developed by the Internal Audit Directorate, outlines the Risk-Based Audit Plan for 
Fisheries and Oceans Canada. The Risk-Based Audit Plan has been designed with the objective of: 


e identifying the priorities of the internal audit activity based on an assessment of risk and potential 
exposure that may affect Fisheries and Oceans Canada entities’ ability to accomplish their 
objectives; 
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° coordinating activities with external assurance service providers and ensuring that government-wide 
audits led by the Comptroller General are taken into account to ensure proper coverage and 
minimize duplication of effort; 


e ensuring the provision of services that are predominantly assurance-based; and 
e allocating internal audit resources to those areas that represent the highest risk and significance. 


The Plan provides the Deputy Minister, the Executive Table and the Departmental Audit Committee with 
a detailed schedule of planned activities for 2018-19 and an overview of potential areas for audit 
engagements for the following year. 


This Plan includes the following sections: 
Internal Audit Directorate (Section 2) 
Approach/Methodology (Section 3) 
Audit Plan Summary (Section 4) 
Audit Resources (Section 5) 


O © E O 


Summary of Audit Coverage (Section 6) 


2.0 INTERNAL AUDIT DIRECTORATE 


2.1 ORGANIZATION 


The Department’s internal audit activity is led by the Chief Audit Executive who reports directly to the 
Deputy Minister. The Chief Audit Executive is responsible for establishing a multi-year Risk-Based Audit 
Plan consistent with the Department’s objectives and priorities, and for maintaining a quality assurance 
and improvement program to monitor the Internal Audit Directorate’s effectiveness. The Chief Audit 
Executive is also responsible for ensuring internal audit resources are professionally qualified and 
appropriately trained. In addition, the Chief Audit Executive communicates relevant information, 
including internal audit findings, to senior management, the Departmental Audit Committee, the Deputy 
Minister and, as appropriate, the Office of the Comptroller General. 


The Internal Audit Directorate consists of two functions namely Internal Audit Services and Professional 
Practices, led by a senior director and a director respectively, both reporting to the Chief Audit 
Executive. The Internal Audit Services function is responsible for providing assurance and consulting 
services while the Professional Practices function supports the internal audit activity and is responsible 
for the quality assurance and improvement program, external audit liaison services and the 
Departmental Audit Committee secretariat. 


2.2 DEPARTMENTAL AUDIT COMMITTEE 


The Departmental Audit Committee is an essential part of the Department’s governance structure and 
of the audit regime established by the TB Policy on Internal Audit. The Departmental Audit Committee 
provides the Deputy Minister with independent, objective advice, guidance and assurance on the 
adequacy of the Department’s risk management, controls, governance processes and audit capacity. 
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In order to fulfill its role, the Departmental Audit Committee is responsible for the following: 


o Providing objective advice and recommendations to the deputy head on the sufficiency, quality 
and results of internal audit engagements related to the adequacy and functioning of the 
department’s frameworks and processes for risk management, control and governance; 

° Using a risk-based approach, reviewing all areas of responsibility for the Departmental Audit 
Committee related to departmental management, control and accountability processes as 
determined by the Comptroller General of Canada; and 

° Providing advice and recommendations on matters for which the deputy head, as accounting 
officer, is responsible and on other related matters as needed or requested by the deputy head. 


The Departmental Audit Committee is composed of the Deputy Minister, the Associate Deputy Minister 
and three external members. The Committee is chaired by one external member. In addition, the 
Commissioner of the Canadian Coast Guard, the Chief Financial Officer, the Senior General Counsel, the 
Assistant Deputy Minister Human Resources & Corporates Services and the Chief Audit Executive are 
permanent observers of the Departmental Audit Committee. 


23 RESOURCES 

The total budget (salary, operations and maintenance funding) of the Internal Audit Directorate for fiscal 
year 2018-19 will be approximately $3 million. With the planned staffing actions, it is anticipated that 
the internal audit function will be delivered through 25 full-time equivalents in 2018-19. 

2.4 INTERNAL AUDIT SERVICES 

Internal audit takes a disciplined, evidence-based approach to provide assurance that key systems and 
processes are appropriately designed and are functioning as intended. As a complement to its assurance 


role, and within its sphere of expertise, the Internal Audit Directorate also provides consulting services. 


This Risk-Based Audit Plan factors in the needs for consulting services to best support management 
while maintaining Internal Audit’s objectivity. 


Sections 2.4.1 and 2.4.2 describe the various assurance and consulting services provided by the Internal 
Audit Directorate. 


2.4.1 Assurance Services (Internal Audits and Reviews) 

Planned Internal Audits 

Audits provide reasonable assurance against defined criteria, following professional internal auditing 
standards, and assurance standards. The scope of audit engagements is defined via a formal planning 


phase that includes a comprehensive risk assessment of the entity being audited. Areas selected for 
audit are based on an annual risk based planning exercise. 
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Directed Internal Audits 


Directed audits provide reasonable assurance in response to ad-hoc request(s) made by the DM, DMA, 
Commissioner, DCs, ADMs or DAC in response to accountability concerns in a particular area. Scope is 

defined via a formal planning phase that includes a comprehensive risk assessment of the entity being 
audited. 


Review 


Review engagements provide an objective assessment of a particular area without the same rigour or 
examination and/or testing of an audit. While not designed to provide reasonable assurance, it can 
provide management with moderate assurance. May be requested by management or initiated by the 
IAD. 


Continuous Audit 


A continuous auditing program provides ongoing and independent assessments of internal control 
frameworks. By utilizing a methodology or a framework that employs audit testing procedures 
combined with automated tools (for data extraction and analysis), it provides assurance on financial and 
non-financial data. 


2.4.2 Consulting Services 


Control / Risk Assessment 


This type of engagement provides a detailed control/risk assessment of a particular area and a 
preliminary assessment of established control processes. The control/risk assessment may lead to 
recommendations or may then be used to inform additional work which may be required (internal or 
external). 


Advice 


Advisory engagements encompass formal and informal processes which may be planned or ad hoc and 
may be requested by management or initiated by the IAD. The scope may include identification of 
control weaknesses and/or significant accountability risks. 


2.5 Professional Practices 
2.5.1 Quality Assurance and Improvement Program 


Pursuant to the Treasury Board Policy on Internal Audit, the Government of Canada adopted the 
Institute of the Internal Auditors International Professional Practices Framework as part of the 
Government of Canada Internal Audit Standards. As part of the Standards, the Chief Audit Executive is 
responsible to develop and maintain a quality assurance and improvement program, including the 
conduct of an external quality assessment of the internal audit function at least every five years. 


The activities of the quality assurance and improvement program also include an internal quality 
assessment of all phases of an audit. To complement its quality assessment activities at the audit 


Internal Audit Directorate 5 
Risk-Based Audit Plan 2018-2020 


000092 


engagement level, the Directorate performs internal assessments at the audit function level. The last 
assessment was performed during Summer 2017. 


The Internal Audit Directorate had an external practice inspection conducted during the Fall of 2015. 
Consequently, the IA Activity was found to be Generally Conforming to the requirements of the TB Policy 
on Internal Audit and the associated Directive, and the IIA Standards. 


2.5.2 Liaison with the Office of the Auditor General and other External Assurance Providers 


The Internal Audit Directorate’s management of liaison activities with the Office of the Auditor General, 
the Office of the Comptroller General, and other external assurance providers helps ensure that the 
activities of the Department are represented accurately, fairly and in a balanced manner. Various 
activities are carried out to ensure positive working relationships and effective coordination of all 
external audit work. Specifically, this includes providing assistance and advice to departmental officials 
throughout the conduct of audits, negotiating acceptable timeframes for providing requested material, 
as well as collaborating with others when validating the factual content of audit reports and preparing 
departmental responses. 


In addition, ministerial responses to petitioners with regards to environmental petitions are coordinated 
with the appropriate Agency/Sectors. 


2.5.3 Follow-up on Management Action Plans 


The Internal Audit Directorate actively and vigorously monitors and reports on the implementation of 
approved Management Action Plans to address internal audit recommendations, as well as 
recommendations stemming from external audits performed by the Office of the Auditor General and 
other external assurance providers. As part of the follow-up process, the Internal Audit Directorate 
requests updates from management, assesses and validates corrective measures that have been taken 
and determines whether the actions carried out are appropriate. 


The Internal Audit Directorate has a strong follow-up process. Status updates are requested on a semi- 
annual basis from the auditees and a summary is presented at the Departmental Audit Committee 
meeting for approval. The process also involves assessing the risks associated with delays in 
implementation. When the implementation of a Management Action Plan is delayed, the representative 
from the relevant Agency/Sector is required to attend the Departmental Audit Committee meeting to 
explain the reasons for the delays and to request an extension. 


When there is a high risk that the corrective actions may not be completed as reported by the auditee, 
the Internal Audit Directorate may conduct a more comprehensive follow-up audit. Follow-up audit 
reports are tabled and approved at the Departmental Audit Committee and posted on the Directorate 
internet site and provided to the Office of the Comptroller General, as for regular internal audit 
engagements. 


2.5.4 Departmental Audit Committee Secretariat 
The Internal Audit Directorate provides administrative and logistical support to the Departmental Audit 


Committee members in order to coordinate and organize the meetings. This includes the preparation of 
the Committee meeting agenda, and the collecting and assembling of meeting material into electronic 
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binders for submission to Departmental Audit Committee members two weeks in advance of each 
meeting. The Internal Audit Directorate also provides support for the preparation of the Departmental 
Audit Committee Annual Work Plan and Report. 


2.5.5 Liaison with the Office of the Comptroller General and participation in their Horizontal 
Internal Audits 


As outlined in the Treasury Board Policy on Internal Audit, the Internal Audit Directorate must consider 
government-wide audits led by the Comptroller General when developing the Risk-Based Audit Plan. 
Horizontal audits planned by the Office of the Comptroller General were taken into account in the 2018- 
2020 Risk-Based Audit Plan. 


The Office of the Comptroller General has adopted a collaborative approach in conducting horizontal 
internal audits by sharing the work between the Office of the Comptroller General and the Internal 
Audit groups in departments. When conducting a horizontal audit in large departments and agencies, 
the Office of the Comptroller General performs the planning of the audit and prepares the audit work 
programs including the steps to take for documentation review and interview questionnaires. The Office 
of the Comptroller General then requires the Internal Audit Directorate of the participating departments 
to provide audit resources (normally one or two) to complete the examination phase. Each department 
may decide to expand the scope of a horizontal audit to address matters of significance specific to their 
department. 


3.0 APPROACH/METHODOLOGY 
3.1 ` PLANNING PROCESS 


This Plan represents an update of the Risk-Based Audit Plan for 2017-2020 that was supported by the 
Departmental Audit Committee and approved by the Deputy Minister in March 2017. 


The Risk-Based Audit Plan for 2018-2020 was developed in accordance with the Treasury Board Policy on 
Internal Audit. The procedures taken to develop the 2018-2020 Risk-Based Audit Plan were based on the 
Office of the Comptroller General Practice guidebook entitled “Internal Audit Planning for Departments 
and Agencies” as well as best practices/areas of improvement found during last year’s update. Fisheries 
and Oceans Canada’s 2017-18 Program Alignment Architecture was used to develop the audit universe. 
This universe represents the inventory of auditable entities in the department organized by strategic 
outcome. 


Building on last year’s assessment and process, the internal audit team undertook the following 
activities to identify high-risk areas and subsequently develop the Risk-Based Audit Plan for 2018-2020: 


o defining the audit universe; 

o document review; 

o OPP risk assessments; and 

o Consultations with senior management and the Departmental Audit Committee. 


The following sub-sections describe these steps in more detail. 
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3.1.1 Audit Universe 


The Department e activities are organized under three strategic outcomes: 
o Economically Prosperous Maritime Sectors and Fisheries; 
o Sustainable Aquatic Ecosystems; and 
o Safe and Secure Waters. 


These strategic outcomes are the basis of the Department’s Program Alignment Architecture for 2017- 
18. The Program Alignment Architecture is an inventory of all the programs and activities undertaken by 
the Department. The Program Alignment Architecture was a major input into the definition of the audit 
universe which forms the basis for selecting areas to audit, defines the potential scope of the internal 
audit activity and is comprised of major auditable units that may be subject to audit. It is the starting 
point of the Risk-Based Audit Plan. As the Department is transitioning to implementing the new Policy 
on Results, the audit universe will be revisited as part of next year’s assessment to ensure it is aligned 
with key core responsibilities and program inventories. 


3.1.2 Document Review 


In order to update the Risk-Based Audit Plan for 2018-2020, the audit team undertook a review of 
relevant documents to identify potential areas of high risk. The following documents were consulted: 


Fisheries and Oceans Canada’s Program Alignment Architecture; 
Fisheries and Oceans Canada’s Corporate Risk Profile; 

Fisheries and Oceans Canada’s Departmental Results Report; 

Fisheries and Oceans Canada’s Departmental Plans; 

Fisheries and Oceans Canada’s Evaluation Plan; 

Fisheries and Oceans Canada’s Internal Audit and Evaluation Reports; 
Past and Current Audit Reports from external assurance providers; and 


O O O O 0 0 0 


Fisheries and Oceans Canada’s departmental priorities. 


In addition, the audit team considered all commitments and priorities identified in the Minister’s 
Mandate Letter issued in August 2016 as well as the planned audit engagements from external 
assurance providers. 


3.1.3 Oceans Protection Plan Risk Assessments 


Given the magnitude of the Oceans Protection Plan (OPP), and the importance of successfully delivering 
on the many sub-initiatives of the Plan on time and on budget, it is important to ensure adequate audit 
coverage for this initiative. In light of this, the Internal Audit Directorate undertook program and project 
level risk assessments, in collaboration with Transport Canada and the Department’s OPP Secretariat, 
and in consultation with the various implicated stakeholders throughout the Department. The risk 
assessments informed the areas of higher risk at the program level (risk topics common to many 
initiatives), and sub-initiative level (projects of higher risks) within OPP for inclusion in the 2018-2020 
Risk-Based Audit Plan. Based on this exercise and consultations with Senior Management, a number of 
engagements related to the Oceans Protection Plan were proposed and included under Section 4 - Audit 
Plan Summary. These engagements will provide assurance to the Department that key program 
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elements are in place and working as intended to support the delivery of the $1.5 billion Oceans 
Protection Plan. 


In addition to the proposed engagements, a validation exercise of the status of the Oceans Protection 
Plan Initiatives will be conducted. This validation process will outline the status of each of the sub- 
initiatives of the Oceans Protection Plan against what is being reported in project dashboards, and may 
inform future engagements to be included in the Audit Plan. There will be an opportunity to collaborate 
with Transport Canada in the conduct of this validation exercise. 


3.1.4 Consultation process 


Consultations were held in the Fall 2017 with members of the Executive Table, as well as key Directors 
General and Assistant Commissioners of the CCG. They were asked to comment on the audits planned 
for 2018-20 and to discuss any particular sources of risk to which their organization was exposed. 


3.1.5 Priority Risk Assessment of the Auditable Entities 


Using all the information collected and analysed through the consultation and document review 
process, the audit team assessed the risks associated with each auditable entity within the audit 
universe. 


Taking into consideration the presence of risk factors, each entity was assigned a risk score. The audit 
team’s knowledge of the controls in place (if any) was also used for assigning a score for each proposed 
audit’s underlying entity. 


Risk factors include: 
o Control Environment; 
o Time since last engagement; 
o Size/Complexity; 
o Materiality; and 
o Strategic Importance to the Department. 


3.1.6 Finalization of the Plan 


The Risk-Based Audit Plan was developed taking into consideration the following elements: 
° high risk areas; 
o resource requirements and availability; 
o other factors, such as: management priorities, planned evaluations, etc.; and 
o the need for the right balance between assurance and consulting services. 


The Plan was presented to the Operations Committee in February 2018. In addition, a conference call 
with the Departmental Audit Committee members was also held in February 2018. The final version of 
the Audit Plan is provided in Section 4. 
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3.2 APPROVAL OF THE RISK-BASED AUDIT PLAN 


The Risk-Based Audit Plan is formally updated by the Internal Audit Directorate on an annual basis, 
reviewed by the Departmental Audit Committee and recommended for approval to the Deputy Minister. 


3.3 MONITORING OF THE RISK-BASED AUDIT PLAN 


The implementation of the Risk-Based Audit Plan will be monitored on a regular basis throughout the 
year and regular status updates will be provided to the Departmental Audit Committee. 


If/when changes to the Risk-Based Audit Plan are deemed necessary; the Internal Audit Directorate 
ensures that the principles of the audit planning process are observed and that all resulting decisions are 
well documented. By following a rigorous process, the Internal Audit Directorate can ensure that new 
decisions are being made in a consistent and timely manner. 


As mentioned previously, the Plan may be updated to address changes. These adjustments will be 


presented to the Departmental Audit Committee for recommendation to the Deputy Minister for 
approval. 


4.0 AUDIT PLAN SUMMARY 


4.1 2018-19 to 2019-20 PLANNED AUDIT WORK 


This section outlines the Risk-Based Audit Plan for 2018-2020 and the proposed engagements for the 
next two years. The engagements will employ audit services that will evaluate the systems of internal 
control in relation to established criteria. 


For year one of the Plan, preliminary audit objectives and scope, as well as resource requirements have 
been identified. In addition, prior to commencing each proposed engagement, a more detailed risk 
assessment will be performed to refine the proposed scope and objective to help ensure it addresses 
the most significant risks. For year two of the Plan, only areas of risk are described. Given the constant 
evolution of the operating and risk environment, audit project realignment based on a Fisheries and 
Oceans Canada updated risk assessment is expected at the next Risk-Based Audit Plan update. 
Preliminary audit objectives and scope as well as resource requirements will be determined at that 
point. 


It should be noted that this Plan is not a budget document and any indication of resource estimates are 
included only as a reference to the expected level of effort required to complete the engagements 
identified in the Plan. While it is estimated that the proposed Plan can be accomplished within the 
budgeted resources (salary, operations and maintenance) allocated for the Internal Audit Directorate, 
the reader is cautioned that retention levels and recruitment efforts may affect the progress against the 
Plan in the next two-year period. The Internal Audit Directorate may have to supplement with 
contracted resources as required. The following table summarizes the proposed audit engagements for 
2018-2020. 
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Document Released Under the Access to 
Information Act / Document divulgué en vertu 
de la Loi sur l’accès à l'information. 


Proposed list of Internal Audit Engagements for Fiscal Year 2018-2020 


Audit of Firearms SE 
Review of OPP Program Level High Risk Areas DRU 
fet Audit of Grants and Contributions CFO 
1 Audit of Indigenous Programs SP 
2 Audit of the Incident Command System CCG 
3 Audit of Classification HRCS 
Audit on the use of Science in decision-making SP/FHM/EOS 
Audit of the Environmental Response Program 
Audit of Staffing HRCS 
7 Placeholder — OPP engagement TBD 
Acronyms: 


CCG: Canadian Coast Guard 

CFO: Chief Financial Officer 

DRU: Delivery and Results Unit 

EOS: Ecosystems and Oceans Science 

FHM: Fisheries and Harbour Management 
HRCS: Human Resources and Corporate Services 
OPI: Office of Primary Interest 

SP: Strategic Policy 

TBD: To be determined 
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5.0 AUDIT RESOURCES 


5.1 SUMMARY OF RESOURCE AVAILABILITY AND CAPACITY 


In 2018-19, the Internal Audit Function will be delivered through 25 full-time equivalents (FTEs). The 
following table summarizes the planned resource utilization by activity: 


Planned Resources Utilization for 2018-19 Full-Time Equivalent — 
Estimates * 

Assurance and Consulting Engagements as per RBAP 16.5 
Corporate Activities 1.0 
Risk-Based Audit Plan 0.7 
Quality Assurance and Improvement Program 0.7 
External Liaison 1.5 
Support to Departmental Audit Committee 0.4 
Human Resources, Finances, Administrative and Support Services 2.1 
Strategic Corporate Planning and Reporting 0.3 
Branch Management 1.4 
Data Analytics 0.4 
Total 25.0 


Resource capacity was determined taking into consideration the current staffing level and planned 
staffing actions. That being said, it should be noted that with the planned staffing actions, it is 
anticipated that the Internal Audit Function will eventually be delivered through 25 FTEs. 


* The numbers presented are estimated. 


5.2 STATEMENT ON THE ADEQUACY OF RESOURCES 


Planned Audit work for fiscal year 2018-19, summarizes the estimated internal resources, contractor 
and travel costs required for each audit in 2018-19. 


The resource needs are adequately covered by the Internal Audit Directorate’s full-time equivalents 
while allowance is made for management action plan follow-up activities, liaison with the Office of the 
Auditor General and other central agencies, support to the Departmental Audit Committee, quality 
assurance and improvement program, professional practices, administrative support, leave and training. 
Should the Internal Audit Directorate budget in future years remain comparable, it is expected that 
resources will be adequate for 2019-20. 


In addition, the Internal Audit Directorate possesses the knowledge and competency required to carry 
out the audit engagements included in the Risk-Based Audit Plan. The majority of the Internal Audit 
Directorate staff possess a Certified Internal Auditor (CIA), Certified Government Auditing Professionals 
(CGAP) and/or Certification in Risk Management Assurance (CRMA). In addition, some employees have 
experience and received training in the use of Audit Command Language (ACL), a data analysis software. 
Several employees have accounting designations and some have a Certified Fraud Examiner (CFE) 
certification. Although the Internal Audit Directorate possesses a broad range of competencies, in the 
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case where a specific expertise is required and not available in-house, internal audit resources may be 
supplemented by external resources as required. 


6.0 SUMMARY OF AUDIT COVERAGE 


APPENDIX A- COVERAGE OF PROGRAM ALIGNMENT ARCHITECTURE 
Appendix A summarizes audit coverage of the audit universe by Program Activity. 


APPENDIX B- RECENT AND ONGOING EXTERNAL AUDITS 


Appendix B summarizes recent and on-going external audits. 


APPENDIX C- COVERAGE OF DEPARTMENTAL PRIORITIES 


Appendix C summarizes audit coverage of the departmental priorities. Some audit engagements address 
more than one departmental priority. 


APPENDIX D- COVERAGE BY AGENCY/SECTOR 


Appendix D summarizes audit coverage by Sector/Agency. 


7.0 APPROVALS 


The Risk-Based Audit Plan was presented at the Departmental Audit Committee on 
March 22, 2018. The Plan was recommended for approval by the Departmental Audit Committee and 
approved by the Deputy Minister. 
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